如何在cloudformation中引用AWS托管策略arn？

Question

我将使用 cloudformation 创建一个 IAM 用户，并且需要附加 AWS 托管策略AWSAppSyncInvokeFullAccess。我想我应该使用像下面的代码这样的托管策略：

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Ref AWSAppSyncInvokeFullAccess
        - !Ref AWSLambdaBasicExecutionRole

但它不起作用，因为AWSAppSyncInvokeFullAccess它来自 AWS，而不是来自此模板。正确的参考政策的方法是什么？

Answer 1

这些是现有的 AWS 托管策略。因此，您应该使用完整的 ARN，您可以从 IAM 控制台获取该 ARN ：

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSAppSyncInvokeFullAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

更新

或者使其分区独立：

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AWSAppSyncInvokeFullAccess"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"